Network attachment for IMS systems for legacy CS UE with home node B access

ABSTRACT

A system and method for allowing legacy circuit switch user equipment (CS UE) to operate via a packet switch system, such as an IP Multimedia Subsystem (IMS) system, is provided. The mobility and session control aspects of communications with the legacy CS UE is separated. A user agent is placed in the receiving node (e.g., a home node B) that acts as the SIP agent for the CS UE for session control. An interworking function is provided to allow mobility between the macro CS network and the PS (e.g., IMS) network. Hand-back and hand-in procedures with service continuity are also provided.

This application claims the benefit of U.S. Provisional Application No.61/099,424, filed on Sep. 23, 2008, entitled “Method of IMS Registrationof CS UE Attached to HNB Using a HNB IP Address/Location Binding at theCLF,” U.S. Provisional Application No. 61/100,999, filed on Sep. 29,2008, entitled “HNB-Macro CS Handovers for IMS Based Femto System,” U.S.Provisional Application No. 61/121,452, filed on Dec. 10, 2008, entitled“Protocol Details of HNB to Macro CS Handover,” U.S. ProvisionalApplication No. 61/140,373, filed on Dec. 23, 2008, entitled “HNB toMacro CS Handover-Single Step Initiation,” U.S. Provisional ApplicationNo. 61/150,667, filed on Feb. 6, 2009, entitled “IMS Registration by HNBof a CS UE with CS Attach Verification,” U.S. Provisional ApplicationNo. 61/098,095, filed on Sep. 18, 2008, entitled “System and Method forProvision of IMS Based Services for Legacy CS UE with Home Node BAccess,” which applications are hereby incorporated herein by reference.This application further claims the benefit of U.S. ProvisionalApplication No. 61/148,889, filed on Jan. 30, 2009, entitled “IMSRegistration by HNB of a CS UE with CS Attach Verification.”

CROSS-REFERENCE TO RELATED APPLICATIONS

This application relates to the following co-pending and commonlyassigned patent applications: Ser. No. 12/486,645, filed Jun. 17, 2009,entitled “System and Method for Provision of IMS Based Services forLegacy CS UE with Home Node B Access,” Ser. No. 12/561,734, filed Sep.17, 2009, entitled “System and Method for Provision of IMS BasedServices for Legacy CS UE with Home Node B Access,” Ser. No. 12/561,850,filed Sep. 17, 2009, entitled “CS to IMS Hand-Back and Hand-in for IMSSystems for Legacy CS UE with Home Node B Access,” and Ser. No.12/561,877, filed Sep. 17, 2009, entitled “IMS to CS Handover for IMSSystems for Legacy CS UE with Home Node B Access,” which applicationsare incorporated herein by reference.

TECHNICAL FIELD

The present invention relates generally to telecommunications and, moreparticularly, to a system and method for providing IP MultimediaSubsystem (IMS)-based services using circuit switch (CS) user equipment(UE) with access over a femtocell system.

BACKGROUND

In telecommunications, a femtocell—originally known as an Access PointBase Station—is a small cellular base station, typically designed foruse in residential or small business environments. It connects to theservice provider's network via broadband (such as DSL or cable). Afemtocell allows service providers to extend service coverage indoors,especially where access would otherwise be limited or unavailable. Thefemtocell incorporates the functionality of a typical base station, butextends it to allow a simpler, self-contained deployment.

A Node B is an element of a 3G macro Radio Access Network (RAN), and aHome Node B (HNB) is the 3GPP's term for a 3G femtocell. Within an HNBAccess Network there are two network elements: a HNB (or femtocell) anda Home Node B Gateway (HNB-GW). The HNB is connected to an existingresidential broadband service and provides 3G radio coverage for 3Ghandsets within a home. The HNB Gateway is installed within anoperator's network and aggregates traffic from a large number of HNBsback into an existing core service network.

As mobile devices improve and include more enhanced capabilities, mobiledevices have evolved to act as Internet Protocol (IP) devices using theHome Node B as an access point. IP devices typically implement IPMultimedia services (IMS) sessions that utilize packet switch (PS)communications instead of CS communications. Legacy CS devices, however,are unable to communicate with the PS network, and hence, the legacy CSdevices are unable to utilize services or take advantage of thecapabilities offered by IMS systems or other PS networks.

Thus, there is a need for a method and system that allows the legacy CSdevices to gain access to IMS services, particularly when communicatingvia a femtocell, e.g., a home node B. There is also a need to allow formobility of the legacy CS devices between CS domains and PS domains.

SUMMARY OF THE INVENTION

These and other problems are generally solved or circumvented, andtechnical advantages are generally achieved, by preferred embodiments ofthe present invention which provides for access to IP multimedia (IMS)sessions using a circuit switch (CS) device.

Embodiments of the present invention provide a system and a method forallowing legacy circuit switched user equipment (CS UE) to operate via apacket switch (PS) system, such as an IP Multimedia Subsystem (IMS)system. An embodiment utilizes a femtocell, such as a home node B, orother cell with an agent that interfaces between the CS system utilizedby the legacy CS UE and the packet switch system.

In an embodiment, the mobility and session control aspects ofcommunications with a legacy CS UE are separated. A home user agent(HUA) is located in the home node B (HNB) and acts as the SIP agent forthe CS UE for session control. An interworking function is provided toallow mobility between the macro CS network and the PS (e.g., IMS)network. When providing legacy services to a CS UE, the HNB gateway (GW)registers with the CS network. In an alternative embodiment, the HNBitself registers with the CS network, thereby providing an additionallevel of security.

In another embodiment, the CS UE is handed over from the PS domain tothe CS domain such that service continuity is maintained for the CS UEby, for example, providing by the HNB the service state information andthe origination information to the IWF.

In yet another embodiment, the CS UE is handed back to the PS domainfrom the CS domain. The hand back may be performed such that a bi-castdownlink bearer channel is established and anchored in the HNB. In analternative embodiment, the bi-cast downlink bearer channel is anchoredin a multimedia resource function (MRF).

In yet still another embodiment, the CS UE is handed in from the CSdomain to the PS domain when IMS services are enabled. In thisembodiment, a bi-cast downlink bearer channel is anchored in the HNB. Inan alternative embodiment, the bi-cast downlink bearer channel isanchored in the media gateway (MGW), and the MGW remains in the bearerpath after hand in is completed.

In an embodiment in which IMS services are not enabled, the bearerchannel is routed from the HNB through the MGW to the CS Core.

In yet still another embodiment, a handover of a CS UE on which anactive session and a held session is established from the PS domain tothe CS domain is performed. The handover may be accomplished using aseries of radio access network application part (RANAP) messages or anewly created message. Alternatively, an existing message with a newinformation element that indicates a handover is requested may also beused.

BRIEF DESCRIPTION OF THE DRAWINGS

For a more complete understanding of the present invention, and theadvantages thereof, reference is now made to the following descriptionstaken in conjunction with the accompanying drawings, in which:

FIG. 1 illustrates a functional architecture diagram in accordance withan embodiment of the present invention;

FIG. 2 illustrates a functional architecture diagram for circuit switchuser equipment network attachment in accordance with an embodiment ofthe present invention;

FIG. 3 is a message flow diagram illustrating circuit switch userequipment network attachment in accordance with an embodiment of thepresent invention;

FIGS. 4 a and 4 b illustrate a message flow diagram for circuit switchuser equipment network attachment in accordance with another embodimentof the present invention;

FIG. 5 illustrates a functional architecture diagram for handover withservice continuity from the PS domain to the CS domain in accordancewith an embodiment of the present invention;

FIG. 6 is a message flow diagram for handover with service continuityfrom the PS domain to the CS domain in accordance with an embodiment ofthe present invention;

FIG. 7 illustrates a functional architecture diagram for hand-back fromthe CS domain to the PS domain in accordance with an embodiment of thepresent invention;

FIG. 8 is a message flow diagram for hand-back from the CS domain to thePS domain in accordance with an embodiment of the present invention;

FIG. 9 illustrates a functional architecture diagram for hand-back fromthe CS domain to the PS domain in accordance with another embodiment ofthe present invention;

FIG. 10 is a message flow diagram for hand-back from the CS domain tothe PS domain in accordance with another embodiment of the presentinvention;

FIG. 11 illustrates a functional architecture diagram for hand-in fromthe CS domain to the PS domain in accordance with an embodiment of thepresent invention;

FIG. 12 is a message flow diagram for hand-in from the CS domain to thePS domain in accordance with an embodiment of the present invention;

FIG. 13 illustrates a functional architecture diagram for hand-in fromthe CS domain to the PS domain in accordance with another embodiment ofthe present invention;

FIG. 14 is a message flow diagram for hand-in from the CS domain to thePS domain in accordance with another embodiment of the presentinvention;

FIG. 15 illustrates a functional architecture diagram for hand-in fromthe CS domain to the PS domain in accordance with yet another embodimentof the present invention;

FIG. 16 is a message flow diagram for hand-in from the CS domain to thePS domain in accordance with yet another embodiment of the presentinvention;

FIG. 17 is a message flow diagram for handover of multiple sessions fromthe PS domain to the CS domain in accordance with an embodiment of thepresent invention;

FIG. 18 is a message flow diagram for handover of multiple sessions fromthe PS domain to the CS domain in accordance with another embodiment ofthe present invention;

FIG. 19 is a message flow diagram for handover of multiple sessions fromthe PS domain to the CS domain in accordance with yet another embodimentof the present invention; and

FIG. 20 is a block diagram of a network element in accordance with anembodiment of the present invention.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

The making and using of the presently preferred embodiments arediscussed in detail below. It should be appreciated, however, that thepresent invention provides many applicable inventive concepts that canbe embodied in a wide variety of specific contexts. The specificembodiments discussed herein are merely illustrative of specific ways tomake and use the invention, and do not limit the scope of the invention.

Embodiments of the present invention are related to provisioning IPMultimedia Subsystem (IMS) services for a legacy CS UE attached to ahome node B (HNB) with verification in the core network that the UE hasbeen authenticated and registered. Additional verification may beperformed by the core network to verify that the user is authenticatedand registered. This verification ensures that the HNB (which is a CPEand hence non trusted entity) does not try to register un-authenticatedusers in IMS.

Embodiments of the present invention allow user equipment (UE)configured to only provide circuit switch (CS) communications to beverified and authorized for access to the packet switch (PS) network,and hence, IMS services. Embodiments of the present invention will bedescribed with respect to embodiments in a specific context, namely asystem and method for the provision of IMS-based services for legacy CSUE with Home Node B Access. Other embodiments of the present invention,however, may be applied to ad hoc networks, cellular networks, wirelinenetworks, and the like, as well as other architectural configurations.

As discussed in greater detail below, an embodiment of the presentinvention provides a Session Initiation Protocol (SIP) user agent (UA)collocated with the HNB for interworking CS session control procedureswith SIP session control procedures. A transport layer interworkingfunction (IWF) is provided for idle mode mobility with collaboration ofthe SIP UA in the HNB. The IWF in collaboration with the SIP UA in theHNB and a SIP Application Server enables active mode mobility betweenHNB and macro CS or macro PS networks.

Referring now to FIG. 1, there is shown a functional architecturediagram in accordance with an embodiment of the present invention. A CSUE 110 comprises a user device and may include any type of deviceproviding voice and/or data access, such as a wireless phone, computer,personal data assistant (PDA), or the like, via a CS communicationspath. Generally, in legacy systems a CS UE connects via a Base StationSubsystem (BSS)/Radio Network Subsystem (RNS) 112, which provides theconnectivity and wireless transmission interface between the CS core 114and the CS UE 110.

In an IMS system, a HNB 116 acts as an access point, typically within auser's home, to provide a PS connection to the 3G PS core 118 via a 3GHNB Gateway (GW) 120. A traditional IMS session is created between a UEand a remote end (not shown), thereby enabling the UE to access mediaflows. The session control signaling flow extends between a Call SessionControl Function (CSCF) 122 and possibly a Service CentralizationContinuity Application Server (SCC AS) 124 or other application servers(126).

Generally, the CSCF 122 processes SIP signaling packets in the IMSsystem, and the application servers 126 host and execute a variety ofservices. In one embodiment, the SCC AS 124 operates in a Back-to-BackUser Agent (B2BUA) mode wherein it acts as an SIP element to mediate SIPsignaling between the UE and the remote end. Application servers may beexecuted on the remote leg as part of standard service execution logicat the CSCF 122.

A home subscriber server (HSS) 128 provides a subscriber database andcontains user-related subscription data, such as location information,security information, user profile information, and the like, requiredto handle IMS sessions.

One of ordinary skill in the art, however, will realize that thearchitecture discussed above fails to provide IMS access to legacy CSUE, such as CS UE 110. In accordance with an embodiment of the presentinvention, a home user agent (HUA) 130 is added to the 3G HNB 116 asillustrated in FIG. 1. The HUA 130 is a logical function that acts as aSIP UA providing SIP session control on behalf of the UE using CSprocedures for voice, preferably located with the 3G HNB 116. The HUA130 provides IMS registration upon a CS attach procedure and interworksCS session/service control with IMS session/service control over an HGminterface point with the CSCF 122, e.g., the IMS system. In a typicalfemtocell access, a PS UE includes a SIP client for access to the PScore. In this case, however, the HUA 130 acts as the SIP client onbehalf of the CS UE 110 (which is not SIP capable), providingtranslation services between the CS UE 110 and the PS network.

The HUA 130 also initiates PS-to-CS and PS-to-PS service continuityprocedures on behalf of the CS UE 110 to provide mobility to the CS UE110. An IWF 132, which provides functionality similar to a mobileswitching center (MSC) in the macro CS network, is responsible forinterfacing with the femtocell system to provide handover capabilitybetween the CS network of the macro CS core 114 and the 3G HNB 116. TheIWF 132 also provides visitor location register (VLR) emulation for CSlocation updates and interfaces with a media gateway (MGW) 134, whichprovides translation services between the IMS network and the macro CSnetwork for media flows over the CS network.

It should be noted that other network elements, such as routers,gateways, switches, and/or the like, may be present within the networks.The configurations and the communications between network elements areprovided for illustrative purposes only, and as such, the communicationsbetween the specified elements may be between different elements and/orthrough additional elements as well as different signaling/commands maybe used.

As discussed in greater detail in the following paragraphs, the generalprinciples of the present invention may be applied to various scenarios.It should be noted that the following embodiments are provided forillustrative purposes only and are not intended to limit the scope ofthe present invention to only those embodiments described herein.Furthermore, it should be noted that the messages and the messageparameters are provided for illustrative purposes only and that othermessages and parameters may be used, as well as any suitable protocol,such as session description protocol (SDP), session initiation protocol(SIP), or the like. Additional information regarding the various networkelements, interfaces, and message flows may be found in 3GPP TS 23.228,v9.0.0 and 3GPP TS 23.237, v9.1.0, which are incorporated herein byreference.

As one of ordinary skill in the art will appreciate, the architecturediscussed above allows a legacy CS UE to use a femtocell system withoutrequiring specialized equipment on the CS UE such that the use of thefemtocell system and the IMS system is transparent to the CS UE and theuser has full mobility between the IMS femtocell system and the macro CSsystem. This is provided by the above architecture due to the separationof the session control and mobility components, such that the sessioncontrol is handled by the HUA 130 in the HNB 116 while the mobility(including location updates and handovers) is handled by the IWF 132 inthe CS domain.

FIG. 2 illustrates a simplified functional architectural diagram inaccordance with an embodiment of the present invention to betterillustrate the separation of the session control and mobilitycomponents. As illustrated in FIG. 2, the CS UE 110 performs a single CSattach procedure with the 3G HNB 116 and the HUA 130, i.e., thefemtocell access point. The 3G HNB 116 and the HUA 130 are collectivelyreferred to as the HNB/HUA 116 for the purposes of this discussion.

The HNB/HUA 116 receives the CS attach request and separates the sessioncontrol and the mobility components. The HNB/HUA 116 initiates twoattach procedures. The first attach procedure initiated by the HNB/HUA116 is a CS attach procedure with the IWF 132 for mobility. A secondattach procedure is an IMS registration procedure, such as an early IMSsecurity registration or a NASS-bundled authentication (NBA) securityregistration. This IMS registration procedure provides access to the IMSsystem and may include establishing an IPsec tunnel. Accordingly, fromthe perspective of the CS UE 110, a single CS attach is performed andthe CS UE 110 is unaware of the separation of the session control andmobility by the HNB/HUA 116.

FIG. 3 is a message flow diagram that further illustrates an attachprocedure with verification that may be used in accordance with anembodiment of the present invention. As indicated by reference numeral310, the HNB GW 120 authenticates the HNB/HUA 116 and the connectionbetween the HNB/HUA 116 and the HNB GW 120. This authentication processmay involve, for example, communication with an authentication,authorization, and accounting (AAA) server. Additional informationregarding this authentication process may be found in 3GPP TS 25.467,v8.2.0, which is incorporated herein by reference.

In step 312, the CS UE 110 initiates a CS attach procedure bytransmitting a CS ATTACH message to the HNB/HUA 116, which transmits theCS ATTACH message to the IWF 132. Upon receiving the CS ATTACH message,the CS location of the CS UE 110 is updated between the IWF 132 and theHSS 128, which may include the appropriate HLR and VLR, in step 314. Anauthentication procedure is also performed to authenticate the CS UE 110and to obtain subscriber data as indicated. The subscriber identity maybe provided by the IWF 132 as part of radio access network applicationpart (RANAP) common ID procedures, whereas the CS UE 110 identity may beprovided by the UE as part of a check in an international mobileequipment identify (IMEI) procedure. Additional information regardingthe CS location update and UE registration to the HNB GW 120 may befound in 3GPP TS 25.467, v8.2.0, which is incorporated herein byreference.

After the CS attach procedure is completed, a CS ATTACH ACCEPT messageis transmitted from the IWF 132 to the CS UE 110 via the HNB/HUA 116 tosignify that the CS attach was successful in step 316. This completesthe CS attachment procedure for mobility within the CS domain.

In step 318, the HNB GW 120 transmits an HNB registration message, e.g.,an HNB REGISTER REQUEST message, to the HSS 128 upon receipt of the CSATTACH ACCEPT message. The HNB REGISTER REQUEST message may include theHNB network address, e.g., the IP address, and the identifier for the CSUE 110, e.g., the international mobile subscriber identity (IMSI)associated with the CS UE 110. Upon receipt of the HNB REGISTER REQUESTmessage, the HSS 128 verifies that the user is registered in the HLR ofthe CS UE 110 and that the CS attach procedure has been performed viathe HNB/HUA 116 that requested the IMS registration as indicated in step320. This verification procedure may be performed at least in part byusing the HNB identity communicated in the HNB REGISTER REQUEST messagein the P-Access-Network-Info header. The HSS 128 may also store thenetwork address of the HNB using procedures similar to Gateway GPRSSupport Node (GGSN), using the Remote Authentication Dial In UserService (RADIUS) protocol to store the HNB IP address and the user'sIMSI in the HSS. Upon successful verification, the HSS 128 transmits anacknowledgement message, e.g., HNB REGISTER ACK message, back to the HNBGW 120, thereby notifying the HNB GW 120 that the CS UE 110 isregistered and verified.

In step 324, the HNB/HUA 116 initiates an IMS registration procedure bytransmitting a REGISTER message to the CSCF 122. The REGISTER messageincludes the IP address of the HUA 130 and the international mobilesubscriber identity (IMSI) derived IP multimedia public identity (IMPU).Thereafter, in step 326, an IMS registration procedure is performedusing, for example, an early IMS security registration or an NBAsecurity registration, thereby completing the session control attachprocedure in the IMS domain.

FIGS. 4 a and 4 b illustrate a message flow diagram that furtherillustrates another attach procedure with verification that may be usedin accordance with another embodiment of the present invention. Steps410-416 correspond to steps 310-316 as described above and will not bedescribed again.

Referring now to step 420, upon successful completion of the CS attachprocedure, the HNB/HUA 116 initiates an IMS access authorizationprocedure by, for example, transmitting an IMS ACCESS AUTHORIZATIONmessage to the HNB GW 120. The HNB/HUA 116 provides to the HNB GW 120 asparameters information regarding the HNB/HUA 116 and the CS UE 110, suchas the HNB identity information, the UE identity information (e.g.,IMSI), and the like.

The HNB GW 120 validates that the received combination of the UEidentity information (e.g., IMSI) and the HNB identity combinationcorrespond to the information stored following the CS attach procedureand, in step 422, forwards the request over the HSS 128 via, forexample, the Hi interface. In step 424, the HSS 128 verifies that the CSUE 110 is authorized via the CS core network. The HSS 128 may grantauthorization by verifying, for example, IMS based HNB subsystem isapplicable to the user, the user has been authenticated by the CS corenetwork, and/or the CS attach procedure was performed through theHNB/HUA requesting the IMS Access Authorization. The specific methodused by the HSS 128 to grant authorization may be dependent upon networkoperator policy. The HSS 128 may also store the network address (e.g.,IP address) of the HNB/HUA 116 as well. The HSS 128 transmits an AccessAuthorization Acknowledgement in step 426.

In step 428, after receiving an indication that the CS UE 110 isauthorized, the HNB/HUA 116 initiates an IMS registration procedure bytransmitting, e.g., an IMS REGISTER message including HUA networkaddress as the contact address and IMSI derived IMPU to the HNB GW 120,which forwards the IMS REGISTER message to the CSCF 122. In anembodiment, the HNB GW 120 implements measures to prevent IMS SIPsignalling from an HNB that has not performed a successful IMSAuthorization Request procedure as described above with reference tosteps 420-426. Furthermore, the HNB GW 120 implements measures toprevent source IP address spoofing. For example, an HNB/HUA 116 mayprohibit transmission of an IP packet with a source IP address (or theprefix in the case of IPv6 stateless auto-configuration) that isdifferent than the one assigned by the HNB GW 120 during the HNBprovisioning procedure.

Thereafter, in step 430, an IMS registration procedure is performedusing, for example, an early IMS security registration or an NBAsecurity registration, thereby completing the session control attachprocedure in the IMS domain.

As one of ordinary skill in the art will realize, the embodimentsdescribed above provide different levels of security. For example, theembodiment described above with reference to FIG. 3 simply verifies thatthe CS UE 110 is authorized in the CS domain, where as long as the HNBGW 120 verifies that the CS UE 110 is authorized in the CS domain, theHNB GW 120 will allow and accept communications from the CS UE 110. As aresult, a hacker eavesdropping on the wireless communications betweenthe CS UE 110 and the HNB/HUA 116 would be able to utilize the user'sidentity, e.g., the IMSI of the CS UE 110, to program another device andconnect through any HNB GW 120, including ones not necessarilyassociated with the CS UE 110.

On the other hand, however, the embodiment disclosed in FIGS. 4 a and 4b not only verifies that the CS UE 110 is authorized, but also that theHNB/HUA 116 is associated with the CS UE 110. Accordingly, thisembodiment only allows the CS UE 110 to attach through the HNB that wasused for the CS Attach procedure and hence is authorized via the CSnetwork, thereby providing a higher level of security.

FIG. 5 illustrates a handover from the PS domain to the CS domain withservice continuity in accordance with an embodiment of the presentinvention. It should be noted that FIG. 5 illustrates the signaling andbearer channels during three different time periods. First, boxes withreference numeral 0 represent the signaling and bearer channels prior tohandover while the CS UE 110 is communicating via the femtocell (e.g.,via the HNB/HUA 116). Next, boxes with reference numeral 1 represent thesignaling and bearer channels after a first stage of handover iscompleted when the CS UE 110 is still communicating via the femtocell,but the bearer channel is routed to the remote end via the MGW 134rather than directly toward the remote end via the HNB GW. Finally,boxes with reference numeral 2 represent the signaling and bearerchannels after handover when the CS UE 110 communicates via the macroCS. It should also be noted that the CSCF 122, the SCC AS 124, and theapplication servers 126 have been collapsed to a single box for ease ofillustration.

Generally, there are two procedures, which may be performed in parallel.The first procedure is for the transfer of the bearer channel from theHNB/HUA 116 in the PS domain to the CS domain. This procedure beginswith the HNB/HUA 116 transmitting a session transfer request to the IWF132, providing the session related information to the IWF 132. The IWF132 establishes the service context for the UE as requested by theHNB/HUA 116 and initiates the Session Transfer using SR-VCC proceduresas defined, for example, in 3GPP TR 23.838, v9.0.0, which isincorporated herein by reference. It should be noted that the HNB/HUA116, the IWF 132, and the SCC AS 124 collaborate to maintain not onlythe service state upon Session Transfer, e.g., a held session remains tobe held upon the SR-VCC Session Transfer procedure, but also to maintainservice context, e.g., whether the session was initiated in the CSdomain or the PS domain. Procedures as defined in 3GPP TR 23.838,v9.0.0, which is incorporated herein by reference, may be used.

The second procedure causes the CS handover from the IWF 132 to the MSCof the CS core 114 controlling the access. The HNB/HUA 116 initiates astandard CS handover procedure toward IWF 132, which uses inter-MSChandover procedures toward the target MSC. The access leg with thesource HNB/HUA 116 is released upon handover.

FIG. 6 is a message flow diagram illustrating messages that may be usedto affect a handover as described above in accordance with an embodimentof the present invention. At an initial stage, a session is establishedbetween CS UE 110 and another party, designated as UE-B 602 in thisembodiment. In step 610, radio measurements between the CS UE 110 andthe HNB/HUA 116 trigger a handover procedure from the HNB/HUA 116 to themacro CS.

In step 612, the HNB/HUA 116 initiates transfer of the session bytransmitting an Initial UE message and a Setup message to the IWF 132.The parameters to the Setup message include the Session Transfer ID(STI) and the SCC AS Public Service Identity (PSI) Domain Name (DN).Furthermore, the Setup message also includes the service state of thesession, such as held, active, and/or the like, and a HNB Indicationparameter that indicates the type of session, e.g., a CS-originatedsession or an IMS-originated session. As one of ordinary skill in theart will realize, the services available to the CS UE 110 may varydepending upon the type of network in which the session was originatedand/or the user's subscription. As a result, the Setup message includesan HNB Indication parameter to indicate whether or not the session wasan IMS-originated session. As will be discussed in greater detail below,the inclusion of the HNB Indication parameter allows continuity of theservices offered and facilitates subsequent hand-back to HNB coverage.

The IWF 132 establishes a context for the CS UE 110 using the servicestate information and the HNB Indication provided in the Setup message,and in step 614, forwards the session transfer request to the SCC AS124. In an embodiment such as that illustrated in FIG. 6, the SCC AS 124transmits an INVITE message that includes the STI and SCC AS PSI DNparameters. In addition, the INVITE message may also include a MGWSession Description Protocol (SDP) parameter, which provides informationrelated to the media port on the MGW 134. In response, the SCC AS 124issues a Re-INVITE message to the UE-B 602 via the CSCF 122, therebynotifying the UE-B 602 of the handover and the change in routinginformation, as indicated in steps 618 and 620.

In step 622, the session transfer of the bearer channel from the HNB GWto the MGW is completed in accordance with, for example, procedures asspecified in 3GPP TS 23.237, v9.1.0, which is incorporated herein byreference. At this point, as indicated in FIG. 6, the bearer channelextends between the CS UE 110 to the HNB/HUA 116 to the MGW 134 to theremote end. This route corresponds to the route identified by the boxeswith reference numeral 1 in FIG. 5.

Thereafter, in step 624, the HNB/HUA 116 signals to the IWF 132 that ahandover is required by, for example, a HANDOVER REQUIRED message. Inresponse, the IWF 132 signals to the appropriate CS CN network element,e.g., the MSC, to prepare for a handover, providing it with thenecessary information in step 626. The handover may be completed per theprocedure defined within 3GPP TS 23.009, v8.1.0, which is incorporatedherein by reference as indicated in step 628. Upon completion of thehandover procedure, the access leg with the HNB/HUA 116 may be released.

One of ordinary skill in the art will realize that at this point thebearer channel extends from the CS UE 110 to the CS CN 114 (e.g., theMSC via the BSS/RNS 112) to the MGW 134 to the remote end.

It should be noted that the designation of CS bearer channels and IMSbearer channels in architecture diagrams such as FIG. 5 and thedesignation of CS bearer channels and IMS bearer channels in messageflow diagrams such as FIG. 6 follow conventions known in the art.Generally, the CS bearer channels and the IMS bearer channels in thearchitecture diagrams illustrate the type of control plane as to whethercontrol plane signaling is CS or IMS, respectively. It should also benoted that CS bearer may include media flows established over IP forsome portions of a call leg, for the case when a MGW provides theinterworking between CS and IP media flows. Thus, it is possible that ona message flow diagram a CS bearer corresponds to or includes an IPmedia flow on the architecture diagram.

FIG. 7 illustrates a hand-back from the CS domain back to the PS domainsuch as that that may occur if after the process described above withreference to FIGS. 5 and 6 service of the UE is handed back to the PSdomain, in accordance with an embodiment of the present invention.Similar to the handover from the PS domain to the CS domain, thehand-back process includes two steps. The first step of the hand-backprocedure performs a hand-back from the MSC in the CS Core 114 to theIWF 132, which acts as the MSC for the PS domain. The CS hand-back fromMSC to IWF 132 may be performed using standard inter-MSC handoverprocedures. The IWF 132 initiates a relocation resource allocationprocedure toward HNB, providing the STI and other session transferinformation such as the current service state, an indication that thesession was initially established by an HNB, and/or the like. In thismanner, the service state and HNB indication is transferred from the IWF132 to the target HNB/HUA 116. Upon receipt, the HNB/HUA 116 performsradio resource allocation and bearer setup toward IWF 132. It should benoted that the target HNB/HUA may be a different HNB/HUA than theHNB/HUA used prior to handover from the HNB/HUA to the CS domain.

The second step of the hand-back procedure performs a CS-to-PS sessiontransfer procedure for the setup of the PS bearer channel. The HNB/HUA116 initiates a session transfer procedure via the HGm interface. TheHNB/HUA 116 establishes a context for the UE using the service stateinformation provided by the HNB/HUA 116 in the first step. The servicestate information allows the HNB/HUA 116 to establish the transfer legin the held state if the session was in the held state at the time ofhandover (hand-back). A downlink bearer path between the remote end andthe target access is established at the HNB/HUA 116 as a result of thisprocedure.

During the hand-back procedure, a bi-cast bearer path is established fordownlink, with one bearer path extending from the remote end to theHNB/HUA 116 to the MGW 134 to the CS Core (MSC) 114 to the BSS/RNS 112to the CS UE 110 and another bearer path extending from the remote endto the HNB/HUA 116 to the CS UE 110. After the hand-back is complete,the bearer path is from the remote end to the HNB/HUA 116 to the CS UE110, and the signaling and bearer channel with the IWF 132 and the CSCore (MSC) 114 is released. This sequence of paths is illustrated by theboxes with the reference numerals in FIG. 7, wherein boxes withreference numeral 0 represent the signaling and bearer channels prior tohand-back, boxes with reference numeral 1 represent the signaling andbearer channels after a first stage of hand-back is completed when dualbearer channels are established, and boxes with reference numeral 2represent the signaling and bearer channels after hand-back iscompleted.

As illustrated in FIG. 7, prior to hand-back, the bearer channel wasanchored in the MGW 134, but after hand-back, the bearer channel isanchored in the HNB GW 120. The use of a bi-cast downlink bearer pathallows for a smoother transition during hand-back with less or noclipping in the service. A single uplink bearer channel anchored in theMGW 134 is utilized, wherein an uplink communication after the downlinkbi-cast bearer channels are established triggers the switch over to thefinal bearer channel path illustrated in FIG. 7.

FIG. 8 is a message flow diagram illustrating messages that may be usedto affect a hand-back procedure such as that described above withreference to FIG. 7 in accordance with an embodiment of the presentinvention. At an initial stage, a session is established between CS UE110 and another party, designated as UE-B 602 in this embodiment. Instep 810, radio measurements between the CS UE 110 and the BSS 112/CSCore (MSC) 114 trigger a hand-back from the macro CS to the HNB/HUA 116.

In step 812, the CS Core (MSC) 114 transmits a message to the IWF 132indicating that the IWF 132 is to prepare for a hand-back. In response,the IWF 132 transmits a RELOCATION REQUEST message to the HNB/HUA 116 instep 814. The parameters of the RELOCATION REQUEST message include theSession Transfer ID (STI), the SCC AS Public Service Identity (PSI)Domain Name (DN), service state information of the session, and an HNBIndication parameter that indicates the type of session, e.g., aCS-originated session or an IMS-originated session.

Upon receipt, in step 816, the HNB/HUA 116 allocates the necessaryresources for the impending hand-back, including allocation of the radioresources for communications with the CS UE 110 as well as allocation ofa bearer channel toward the IWF 132 and the MGW 134. In step 818, theHNB/HUA 116 transmits an INVITE message that includes the STI and a HUASDP as parameters to the CSCF 122. The HUA SDP specifies informationnecessary for a media flow to be established with the HUA SIP client onthe HNB/HUA 116. The INVITE message is forwarded to the SCC AS 124.

In step 820, the SCC AS 124 issues a Re-INVITE message to the UE-B 602via the CSCF 122. As a result of this process, a bearer channel isestablished from the UE-B 602 to the HNB/HUA 116 to the MGW 134 to theCS Core (MSC) 114 to the BSS 112 to the CS UE 110. It should be notedthat at this point the bearer channel flows through the HNB/HUA 116, butthe HNB/HUA 116 does not couple the bearer channel directly to the CS UE110. This is indicated in FIG. 8 by the partial bearer channel betweenthe HNB/HUA 116 and the CS UE 110.

Next, in step 822, the session transfer is completed using, for example,procedures defined in 3GPP TS 23.237, v9.1.0, which is incorporatedherein by reference, and in step 824, the inter-MSC hand-back procedureis completed using, for example, procedures defined in 3GPP TS 23.009,v8.1.0, which is incorporated herein by reference. To complete theprocess, the CS UE 110 may transmit a RELOCATION COMPLETE message toindicate that the hand-back procedure is complete. As illustrated inFIG. 8, the bearer channel now exists from the CS UE 110 to the HNB/HUA116 to the UE-B 602.

FIG. 9 illustrates another method of performing a hand-back from the CSdomain back to the PS domain such as that that may occur if after theprocess described above with reference to FIGS. 5 and 6 service of theUE is handed back to the PS domain, in accordance with an embodiment ofthe present invention. It should be appreciated that the hand-backprocess described above with reference to FIGS. 7 and 8 is handled bythe MGW 134. The process discussed below with reference to FIGS. 9 and10, however, control the hand-back process by the SCC AS 124.

The method illustrated in FIG. 9 is similar to that illustrated in FIG.7, except that the bi-cast downlink channel is anchored in a MultimediaResource Function (MRF) 910 in the embodiment illustrated in FIG. 9rather than being anchored in the HNB/HUA 116 as illustrated in FIG. 7.In this embodiment, the SCC AS 124 employs a downlink bi-cast toward thetarget access leg via the MRF 910 upon receipt of a SESSION TRANSFERrequest and subsequently establishes bi-directional link between theremote leg via the MRF 910 with the target access leg upon detection ofthe first uplink packet from the target Access Leg.

FIG. 10 is a message flow diagram illustrating messages that may be usedto affect a hand-back procedure such as that described above withreference to FIG. 9 in accordance with an embodiment of the presentinvention. Steps 1010-1020 of FIG. 10 are similar to steps 810-820 ofFIG. 8, except that the SCC AS 124 issues a Re-INVITE message thatcauses a bi-cast bearer channel to be established at the MRF 910. Asillustrated in FIG. 10, UE-B 602 has a bearer channel to the MRF 910,and the MRF has two bearer channels directed toward the CS UE 110. Afirst bearer channel is established from the MRF 910 to the HNB/HUA 116,and a second bearer channel is established from the MRF 910 to the MGW134 to the CS Core (MSC) 114 to the BSS 112 to the CS UE 110. At thispoint, the HNB/HUA 116 does not complete the connection with the CS UE110.

Steps 1022-1026 of FIG. 10 perform similar functions as steps 822-826 ofFIG. 8. As a result of this process, the bearer channel between theHNB/HUA 116 and the CS UE 110 is completed and the bearer channel viathe MGW 134 is released.

FIG. 11 illustrates a hand-in from the CS domain to the PS domain inaccordance with an embodiment of the present invention. While thediscussion above relates to handover and hand-back procedures, theprocess discussed with reference to FIG. 11 is a hand-in procedurewherein a session is initiated in the CS domain and handover (orhand-in) to the PS domain is to be performed.

Similar to the hand-back from the CS domain to the PS domain, thehand-in process from the CS domain to the PS domain includes two steps.The first step of the hand-in procedure performs a hand-in from the MSCin the CS Core 114 to the IWF 132, which acts as the MSC for the PSdomain. The CS hand-in from MSC to IWF 132 may be performed usingstandard inter-MSC handover procedures. The IWF 132 initiates arelocation resource allocation procedure toward HNB, but in this casethe IWF 132 does not have the STI or other session transfer informationto pass to the HNB. An indication that the session was not initiallyestablished by an HNB, however, is provided by the IWF 132. Uponreceipt, the HNB/HUA 116 performs radio resource allocation and bearersetup toward IWF 132.

The second step of the hand-in procedure performs a CS-to-PS sessiontransfer procedure for the setup of the PS bearer channel. The HNB/HUA116 initiates a session transfer procedure via the HGm interface. TheHNB/HUA 116 establishes a context for the UE in the basic service stateusing STI information. In an embodiment, the STI information is staticSTI information that is pre-provisioned to identify the session thatneeds to be transferred, see, e.g., 3GPP TS 23.237, v9.1.0, which isincorporated herein by reference. A downlink bearer path between theremote end and the target access is established at the HNB/HUA 116 as aresult of this procedure.

During the hand-in procedure, a bi-cast bearer path is established fordownlink, with one bearer path extending from the remote end to theHNB/HUA 116 to the MGW 134 to the CS Core (MSC) 114 to the BSS/RNS 112to the CS UE 110 and another bearer path extending from the remote endto the HNB/HUA 116 to the CS UE 110. After the hand-in is complete, thebearer path is from the remote end to the HNB/HUA 116 to the CS UE 110,and the signaling and bearer channel with the IWF 132 and the CS Core(MSC) 114 is released. This sequence of paths is illustrated by theboxes with the reference numerals in FIG. 11, wherein boxes withreference numeral 0 represent the signaling and bearer channels prior tohand-in, boxes with reference numeral 1 represent the signaling andbearer channels after a first stage of hand-in is completed when bi-castbearer channels are established, and boxes with reference numeral 2represent the signaling and bearer channels after hand-in is completed.As illustrated in FIG. 11, prior to hand-in, the bearer channel wasanchored in the MGW 134, but after hand-in, the bearer channel isanchored in the HNB GW 120, thereby removing the MGW 134 from the bearerpath.

FIG. 12 is a message flow diagram illustrating messages that may be usedto affect a hand-in procedure such as that described above withreference to FIG. 11 in accordance with an embodiment of the presentinvention. At an initial stage, a session is established between CS UE110 and another party, designated as UE-B 602 in this embodiment. Instep 1110, radio measurements between the CS UE 110 and the BSS 112/CSCore (MSC) 114 trigger a hand-in from the macro CS to the HNB/HUA 116.

In step 1112, the CS Core (MSC) 114 transmits a message to the IWF 132indicating that the IWF 132 is to prepare for a hand-in. In response,the IWF 132 transmits a RELOCATION REQUEST message to the HNB/HUA 116 instep 1114. The parameters to the RELOCATION REQUEST message a HNBIndication parameter that indicates the type of session, e.g., aCS-originated session in this case.

Upon receipt, the HNB/HUA 116 allocates the necessary resources for theimpending hand-in, including allocation of the radio resources forcommunications with the CS UE 110 as well as allocation of a bearerchannel toward the IWF 132 and the MGW 134 as shown in step 1116. Instep 1118, the HNB/HUA 116 transmits an INVITE message that includes theSTI and a HUA SDP as parameters to the CSCF 122. The HUA SDP specifiesinformation necessary for a media flow to be established with the HUASIP client on the HNB/HUA 116. The INVITE message is forwarded to theSCC AS 124.

The SCC AS 124 issues a Re-INVITE message to the UE-B 602 via the CSCF122 in step 1120. As a result of this process, a bearer channel isestablished from the UE-B 602 to the HNB/HUA 116 to the MGW 134 to theCS Core (MSC) 114 to the BSS 112 to the CS UE 110. It should be notedthat at this point the bearer channel flows through the HNB/HUA 116, butthe HNB/HUA 116 does not couple the bearer channel directly to the CS UE110. This is indicated in FIG. 12 by the partial bearer channel betweenthe HNB/HUA 116 and the CS UE 110.

Next, in step 1122, the session transfer is completed using, forexample, procedures defined in 3GPP TS 23.237, v9.1.0, which isincorporated herein by reference, and in step 1124, the inter-MSChand-in procedure is completed using, for example, procedures defined in3GPP TS 23.009, v8.1.0, which is incorporated herein by reference. Tocomplete the process, the CS UE 110 may transmit a RELOCATION COMPLETEmessage to indicate that the hand-in procedure is complete in step 1126.As illustrated in FIG. 11, the bearer channel now exists from the CS UE110 to the HNB/HUA 116 to the UE-B 602, with the MGW 134 being removedfrom the bearer path.

FIG. 13 illustrates another hand-in procedure from the CS domain to thePS domain in accordance with another embodiment of the presentinvention. As will be discussed in greater detail below, the hand-inprocedures discussed above with reference to FIGS. 11 and 12 removed theMGW 134 from the bearer path after the hand-in procedure was completed.In the hand-in procedure illustrated with reference to FIGS. 13 and 14,however, the MGW 134 remains in the bearer path after the hand-in iscompleted.

Accordingly, the hand-in procedure performs a hand-in from the MSC inthe CS Core 114 to the IWF 132, which acts as the MSC for the PS domain.The CS hand-in from MSC to IWF 132 may be performed using standardinter-MSC handover procedures. The IWF 132 initiates a relocationresource allocation procedure toward HNB, but in this case the IWF 132does not have the STI or other session transfer information to pass tothe HNB. An indication that the session was not initially established byan HNB, however, is provided by the IWF 132. Upon receipt, the HNB/HUA116 performs radio resource allocation and bearer setup toward IWF 132.

At this point, a bi-cast bearer path is established for downlink, withone bearer path extending from the remote end to the MGW 134 to the CSCore (MSC) 114 to the BSS/RNS 112 to the CS UE 110 and another bearerpath extending from the remote end to the MGW 134 to the HNB/HUA 116 tothe CS UE 110. After the hand-in is complete, the bearer path is fromthe remote end to MGW 134 to the HNB/HUA 116 to the CS UE 110, and thesignaling and bearer channel from the MGW 134 to the CS Core (MSC) 114to the BSS/RNS 112 to the CS UE 110 are released. This sequence of pathsis illustrated by the boxes with the reference numerals in FIG. 13,wherein boxes with reference numeral 0 represent the signaling andbearer channels prior to hand-in, boxes with reference numeral 1represent the signaling and bearer channels after a first stage ofhand-in is completed when bi-cast bearer channels are established, andboxes with reference numeral 2 represent the signaling and bearerchannels after hand-in is completed. As illustrated in FIG. 13, the MGW134 remains in the bearer path after hand-in is completed.

FIG. 14 is a message flow diagram illustrating messages that may be usedto affect a hand-in procedure such as that described above withreference to FIG. 13 in accordance with an embodiment of the presentinvention. At an initial stage, a session is established between CS UE110 and another party, designated as UE-B 602 in this embodiment. Instep 1410, radio measurements between the CS UE 110 and the BSS 112/CSCore (MSC) 114 trigger a hand-in from the macro CS to the HNB/HUA 116.

In step 1412, the CS Core (MSC) 114 transmits a message to the IWF 132indicating that the IWF 132 is to prepare for a hand-in. In response,the IWF 132 transmits a RELOCATION REQUEST message to the HNB/HUA 116 instep 1414. The parameters of the RELOCATION REQUEST message an HNBIndication parameter that indicates the type of session, e.g., aCS-originated session in this case.

Upon receipt, in step 1416, the HNB/HUA 116 allocates the necessaryresources for the impending hand-in, including allocation of the radioresources for communications with the CS UE 110 as well as allocation ofa bearer channel toward the IWF 132 and the MGW 134. One skilled in theart will appreciate that the INVITE/Re-INVITE messages discussed abovewith reference to FIG. 12 are not used in this embodiment. As a result,the bi-cast bearer channels are anchored in the MGW 134 as illustratedin FIG. 14, rather than being anchored in the HNB/HUA 116 as illustratedin FIG. 12. In particular, a bearer channel is established from the UE-B602 to the MGW 134 to the CS Core (MSC) 114 to the BSS 112 to the CS UE110, with a bi-cast bearer channel established between the MGW 134 andthe HNB/HUA 116. It should be noted that at this point the bearerchannel flows to the HNB/HUA 116, but the HNB/HUA 116 does not couplethe bearer channel directly to the CS UE 110. This is indicated in FIG.14 by the partial bearer channel between the HNB/HUA 116 and the CS UE110.

Next, in step 1418, the inter-MSC hand-in procedure is completed using,for example, procedures defined in 3GPP TS 23.009, v8.1.0, which isincorporated herein by reference. To complete the process, the CS UE 110may transmit a RELOCATION COMPLETE message to indicate that the hand-inprocedure is complete in step 1420. As illustrated in FIG. 14, thebearer channel now exists from the CS UE 110 to the HNB/HUA 116 to theMGW 134 to the UE-B 602, with the MGW 134 remaining in the bearer path.

FIG. 15 illustrates another hand-in procedure from the CS domain to thePS domain in accordance with another embodiment of the presentinvention. It should be noted, however, that the hand-in proceduresdiscussed above with reference to FIGS. 11-14 discussed the situation inwhich IMS services were enabled, thereby allowing the PS network to beutilized. The embodiment illustrated in FIG. 15, on the other hand,illustrates a hand-in procedure that may be utilized when the PS networkis not to be utilized. This embodiment allows the femtocell HNB/HUA 116to be utilized as an access point, but the traffic remains CS and isrouted to the MGW 134 and the CS Core (MSC) 114 rather than being routedto the IMS network.

Accordingly, the hand-in procedure performs a hand-in from the MSC inthe CS Core 114 to the IWF 132. The CS hand-in from MSC to IWF 132 maybe performed using standard inter-MSC handover procedures. The IWF 132initiates a relocation resource allocation procedure toward HNB/HUA 116without providing the STI or other session transfer information to passto the HNB. An indication that the session was not initially establishedby an HNB, however, is provided by the IWF 132. Upon receipt, theHNB/HUA 116 performs radio resource allocation and bearer setup towardIWF 132.

At this point, a bi-cast bearer path is established for downlink, withone bearer path extending from the remote end to the MGW 134 to the CSCore (MSC) 114 to the BSS/RNS 112 to the CS UE 110 and another bearerpath extending from the remote end to the MGW 134 to the HNB/HUA 116 tothe CS UE 110. After the hand-in is complete, the bearer path is fromthe remote end to MGW 134 to the HNB/HUA 116 to the CS UE 110, and thesignaling and bearer channel with from the CS Core (MSC) 114 to theBSS/RNS 112 to the CS UE 110 is released. This sequence of paths isillustrated by the boxes with the reference numerals in FIG. 15, whereinboxes with reference numeral 0 represent the signaling and bearerchannels prior to hand-in, boxes with reference numeral 1 represent thesignaling and bearer channels after a first stage of hand-in iscompleted when bi-cast bearer channels are established, and boxes withreference numeral 2 represent the signaling and bearer channels afterhand-in is completed. As illustrated in FIG. 15, the MGW 134 remains inthe bearer path after hand-in is completed.

FIG. 16 is a message flow diagram illustrating messages that may be usedto affect a hand-in procedure such as that described above withreference to FIG. 15 in accordance with an embodiment of the presentinvention. Steps 1610-1620 of FIG. 16 are similar steps as steps1410-1420 of FIG. 14, except that a CS bearer channel is establishbetween the MGW 134 and the HNB/HUA 116. As a result, the MGW 134 routesthe CS bearer channel to the CS Core 114 rather than a PS bearer channelto the remote end.

FIG. 17 is a message flow diagram illustrating messages that may be usedto affect a handover in accordance with another embodiment of thepresent invention. The processes discussed above relate to a singlesession situation, i.e., situations in which the CS UE 110 has only asingle session instantiated. FIG. 17, however, illustrates a messageflow in which the CS UE 110 has two sessions—one session in the activestate between the CS UE 110 and UE-B 602, and another session in thehold state between the CS UE 110 and UE-C 1700. In step 1710, radiomeasurements between the CS UE 110 and the HNB/HUA 116 trigger ahandover from the HNB/HUA 116 to the macro CS.

Generally, RANAP as described in 3GPP TS 25.413, v8.3.0, which isincorporated herein by reference, defines an information element calledNon-Access Stratum Protocol Data Unit (NAS PDU) (see clause 9.2.3.5 NASPDU of 3GPP TS 25.413, v8.3.0), which is an Octet String used to embedNAS messages inside RANAP messages. For example, 3GPP TS 24.008, v8.6.0,messages are sent in Initial UE and Direct Transfer messages byembedding them in the NAS PDU information element of the respectiveRANAP message. An HNB implementation uses the NAS PDU InformationElement (IE) such that it contains a “HNB Header” followed by thestandard 3GPP TS 24.008, v8.6.0, message. The HNB Header may contain anyHNB specific information related to the NAS procedure being requested bythe RANAP message. For example, the HNB Header may be used tocommunicate the HNB Handover Service Request type in the Initial UEmessage sent by the HNB to the IWF (or MSC Server) to initiate handoverto Macro CS. As another example, the HNB Header may be used tocommunicate voice session state information such as theheld/active/conference/call transfer state or the information needed toidentify the Source Access Leg for Session Transfer via a RANAP DirectTransfer message.

Referring back to FIG. 17, in steps 1712-1716, the HNB/HUA 116 initiatestransfer of the active session in accordance with an embodiment. Forexample, in step 1712, the HNB/HUA 116 sends an Initial UE message witha CMSReq with a service type “Mobile Originated Call Establishment” andan indication of HNB Handover in the NAS PDU IE, thereby causing the IWF132 to suppress the Authentication and Security procedures for theservice request. Alternatively a new service type defined specificallyfor this purpose may be sent in CMSReq.

The indication of HNB handover is preferred with the CMSReq so that theIWF 132 is able to process CMSReq for normal mobile originations (e.g.,for CS-Data, Fax, or Emergency calls) according to standard procedures,and suppress Auth/Security only for CMSReq used for HNB Handover.Alternatively, the IWF 132 may be configured to suppress Auth/Securityfor all CMSReq using service type equal to “Mobile Originated callestablishment.”

Next, in step 1714, the HNB/HUA 116 sends a Direct Transfer messagewith, for example, 3GPP TS 24.008, v8.6.0, Setup in its NAS PDU IE toestablish the context for the active CS UE 110-UE-B 602 session. In the3GPP TS 24.008, v8.6.0, Setup is included a STN to request a SR-VCCSession Transfer, and a 3GPP TS 24.008, v8.6.0, transaction identifier(TI) to identify the CS UE 110-UE-B 602 session for service control posttransfer.

The 3GPP TS 24.008, v8.6.0, TI sent by the HNB/HUA 116 in 3GPP TS24.008, v8.6.0, Setup is preferably the same as the TI allocated atestablishment of the session that is being transferred so that the CS UE110 can continue to use the same TI for service control post handover.The IWF 132 identifies a Setup with a STN from an HNB for specialhandling to process a TI that may be of the format of a TI used for CStermination, e.g., when transferring a session that was terminated tothe CS UE 110 via the HNB access. The Direct Transfer message mayoptionally contain the Source Access Leg's STI to identify the SourceAccess Leg of the CS UE 110-UE-B 602 session established via HNB access.It may alternatively contain the connected party (UE-B 602) number as ameans to identify the session. The STI and/or the UE-B 602 number may beprovided in the 24.008 Setup message (e.g., in additional called partynumber IE or UU1 or Facility IE) and/or HNB header of the NAS PDU IE inRANAP Direct Transfer.

The STI of the source access leg may be needed to identify the sourceAccess Leg to the SCC AS 124 for the purpose of Session Transfer and maybe provided in the NAS PDU IE of RANAP Direct Transfer. Alternatively,the STI for the source access leg may be allocated to be the same as the3GPP TS 24.008, v8.6.0, TI used for the session to be transferred; inwhich case, only the TI is sufficient.

Thereafter, in step 1716, the receipt of Setup message results in RABAssignment procedure at the IWF 132 and the HNB/HUA 116 and the HNB/HUA116 sends the Relocation Required message to initiate handover to targetBSS 112. The IWF 132 then follows with completion of the procedure fortransfer of the active CS UE 110-UE-B 602 session at the SCC AS 124. Inparallel, the target resource allocation procedure takes place at thetarget MSC 114 resulting in completion of handover toward target BSS 112and switching of the CS UE 110 from HNB/HUA 116 to target BSS 112. Instep 1718, the inter-MSC handover procedure is completed using, forexample, procedures defined in 3GPP TS 23.009, v8.1.0, which isincorporated herein by reference.

As illustrated in FIG. 17, an IMS bearer channel is established betweenthe UE-B 602 and the HNB/HUA 116, and a CS bearer channel is establishedfrom the HNB/HUA 116 to the MGW 134 to the CS Core (MSC) 132 to the BSS112 to the CS UE 110.

In step 1720, HNB/HUA 116 sends a Direct Transfer message with 3GPP TS24.008, v8.6.0, Setup message in the NAS PDU IE to establish the contextfor the held CS UE 110-UE-C 1700 session. In the 3GPP TS 24.008, v8.6.0,Setup is included a STN-SR to request a SR-VCC Session Transfer and a3GPP TS 24.008, v8.6.0, TI to identify the CS UE 110-UE-C 1700 sessionfor service control post transfer. The Direct Transfer message mayoptionally contain the Source Access Leg's STI to identify the SourceAccess Leg of the CS UE 110-UE-C 1700 session established via HNBaccess. It may alternatively contain the connected party (UE-C) numberas means to identify the session. The STI and/or the UE-C party numbermay be provided in the 3GPP TS 24.008, v8.6.0, Setup message (e.g., inadditional called party number IE or UU1 or Facility IE) and/or HNBheader of the NAS PDU IE in RANAP Direct Transfer. The IWF 132 thenfollows with completion of the procedure for transfer of the held CS UE110-UE-C 1700 session at the SCC AS 124.

One of ordinary skill in the art will realize that the above processutilizes existing protocols and messages, such as the RANAP messages, topass the information necessary to perform a handover. This reuse ofexisting messages has the benefit of having little or no impact existingsystems.

FIG. 18 is a message flow diagram illustrating messages that may be usedto affect a handover using a single step initiation procedure inaccordance with another embodiment of the present invention. As one willappreciate, the handover process discussed above with reference to FIG.17 utilized a plurality of existing messages/steps to initiate theprocess. The process illustrated in FIG. 18, however, utilizes asingle-step handover procedure from the PS domain to the CS domain, butmay require a new message and/or message format.

Referring first to step 1810, radio measurements between the CS UE 110and the HNB/HUA 116 trigger a handover from the HNB/HUA 116 to the macroCS. In step 1812, the HNB/HUA 116 initiates handover toward BSS/RNC 112by transmitting an SRVCC PS to CS REQUEST message with an indication ofHNB Handover in the PDU IE, so that the IWF 132 performs HNB specificactions described below with respect to step 1814 besides the ones forSRVCC.

It should be noted that the context of the sessions in HNB/HUA 116 maybe included in the request message. The context may include each 3GPP TS24.008, v8.6.0, TI and associated session state in order to restore thesession states in the IWF and allow the CS UE 110 to continue to use thesame TI as the TI allocated at establishment of the session that isbeing transferred for service control post handover.

The STI of the source Access Leg may also be provided to identify thesource Access Leg to the SCC AS for the purpose of Session Transfer. TheSTI for the source Access Leg may be allocated to be the same as the3GPP TS 24.008, v8.6.0, TI used for the session to be transferred, inwhich case only the TI may be sufficient. The STIs of the source AccessLeg are associated with the session states in the HNB.

Furthermore, these TIs and/or STIs may be populated in sequence, thusthe IWF 132 can initiate VCC session transfer according to the ordergiven by HNB/HUA 116.

In an embodiment, the parameters mentioned to be transferred to the IWFabove may be provided in the PDU IE of RANAP Relocation Required or inthe PDU IE of SRVCC PS to CS Request message (shown in this case)defined for Sv interface.

In step 1814, the IWF determines this is an HNB triggered handover fromfemtocell to macro CS cell by the called indication of HNB andestablishes the contexts for the sessions. In the SRVCC PS to CS Requestis included STI(s) to request a Session Transfer and 3GPP TS 24.008,v8.6.0, TI(s) to identify the sessions for service control posttransfer. Steps 1814A-1-1814A-5 and steps 1814B-1-1814B-2 identify theindividual steps for this process.

In steps 1814A-1 and 1814A-2, the TI and/or STI of CS UE 110-UE-B 602session is included in the request, so the IWF follows with completionof the procedure for transfer of the active CS UE 110-UE-B 602 sessionat the SCC AS 124. In step 1814A-3, the SCC AS completes theestablishment of the Access Leg via the CS access. The SCC AS performsthe Access Transfer by updating the Remote Leg with the connectioninformation of the newly established Access Leg using the Remote LegUpdate procedure. The SCC AS completes the session setup towards UE.

Next, in step 1814A-4, the IWF initiates the subsequent session transferfor the CS UE 110-UE-C 1700 held session according to the determinedorder. The procedure is basically the same as the steps of1814A-1-1814A-3. The Source Access Leg (which is the Access Legpreviously established over PS access) is released as defined in 3GPP TS23.237, v9.1.0, as illustrated in step 1814A-5.

In step 1814B-1, in parallel the target resource allocation proceduretakes place at the target MSC resulting in completion of handover towardtarget BSS/RNC and switching of the CS UE 110 from HNB/HUA 116 to thetarget BSS.

It should be noted the sequence of the steps 1814A-1-1814A5 and steps1814B-1-1814B-2 is coordinated by the IWF as the same as SRVCC.

As illustrated in FIG. 18, an IMS bearer channel is established betweenthe UE-B 602 and the MGW, and a CS bearer channel is established fromthe MGW 134 to the CS Core (MSC) 114 to the BSS 112 to the CS UE 110.

FIG. 19 is a message flow diagram illustrating messages that may be usedto affect a handover using a single step initiation procedure inaccordance with another embodiment of the present invention. Referringfirst to step 1910, radio measurements between the CS UE 110 and theHNB/HUA 116 trigger a handover from the HNB/HUA 116 to the macro CS. Instep 1912, the HNB/HUA 116 initiates handover toward BSS/RNC bytransmitting an SRVCC PS to CS Request message with an indication of HNBHandover in the PDU IE, so that the IWF performs HNB specific actionsdescribed below with respect to step 1914 besides the ones for SRVCC.

It should be noted that the context of the sessions in HNB/HUA 116 maybe included in the request message. The context may include each 3GPP TS24.008, v8.6.0, TI and associated session state in order to restore thesession states in the IWF and allow the CS UE 110 to continue to use thesame TI as the TI allocated at establishment of the session that isbeing transferred for service control post handover.

Furthermore, these TIs and/or STIs may be populated in sequence, thusthe IWF can initiate VCC session transfer according to the order givenby HNB/HUA 116.

In an embodiment, the parameters mentioned to be transferred to the IWFabove may be provided in the PDU IE of RANAP Relocation Required or inthe PDU IE of SRVCC PS to CS Request message (shown in this case)defined for Sv interface.

In step 1914, the IWF determines this is an HNB triggered handover fromfemtocell to macro CS cell by the called indication of HNB andestablishes the contexts for the sessions. In the SRVCC PS to CS Requestis included STI(s) to request a Session Transfer and 3GPP TS 24.008,v8.6.0, TI(s) to identify the sessions for service control posttransfer. Steps 1914A-1-1914A-7 and steps 1914B-1-1914B-2 identify theindividual steps for this process.

In steps 1914A-1 and 1914A-2, the TI and/or STI of CS UE 110-UE-B 602session is included in the request, so the IWF follows with completionof the procedure for transfer of the active CS UE 110-UE-B 602 sessionat the SCC AS. In step 1914A-3, the SCC AS completes the establishmentof the Access Leg via the CS access. The SCC AS performs the AccessTransfer by updating the Remote Leg with the connection information ofthe newly established Access Leg using the Remote Leg Update procedure.The SCC AS completes the session setup towards UE.

Next, in steps 1914A-4 and 1914A-5, the SCC AS provides session stateinformation on additional active and inactive sessions with speech mediaincluding needed STIs on the transferring-in leg. In step 1914A-6, theIWF initiates the subsequent session transfer for the CS UE 110-UE-C1700 held session according to the determined order. The procedure isbasically the same as the steps of 1914A-1-1914A-3. The Source AccessLeg (which is the Access Leg previously established over PS access) isreleased as defined in 3GPP TS 23.237, v9.1.0, as illustrated in step1914A-5.

In step 1914B-1, in parallel the target resource allocation proceduretakes place at the target MSC resulting in completion of handover towardtarget RNC/BSC and switching of the CS UE 110 from HNB/HUA 116 to thetarget BSS.

It should be noted the sequence of the steps 1914A-1-1914A-5 and steps1914B-1-1914B-2 is coordinated by the IWF as the same as SRVCC.

As illustrated in FIG. 19, an IMS bearer channel is established betweenthe UE-B 602 and the MGW 134, and a CS bearer channel is establishedfrom the MGW 134 to the CS Core (MSC) 114 to the BSS 112 to the CS UE110.

With respect to FIGS. 18 and 19, the IWF performs IMS Registration forthe UE when using the I2 interface. The sequence of the A-series ofsteps and the B-series of steps may be coordinated by the IWF as thesame as SRVCC.

Additional reference may be made to 3GPP TS 29.280, v8.1.0, 3GPP EPS SvInterface (MME to MSC) for SRVCC, which is incorporated herein byreference.

The IE for the SRVCC PS to CS REQUEST message may include, among otherthings, the IMSI, the address for control plane messages that are chosenby the source mobility management entity (MME)/SGSN, the tunnel for thecontrol plane message, the Mobile Subscriber Integrated Services DigitalNetwork Number (MSISDN), STN-SR, and the CS security key in mobilitymanagement (MM) context for SRVCC.

A SRVCC PS to CS Request message, such as that discussed above withreference to step 1812 of FIG. 18, may be sent across Sv interface fromthe MME/SGSN to the target MSC server as part of the MME/SGSN SRVCCprocedure as defined in 3GPP TS 23.216, v9.0.0, which is incorporatedherein by reference. (See also 3GPP TS 25.413, v8.3.0, which isincorporated herein by reference.) Table 1 defines the IEs of thismessage in accordance with an embodiment of the present invention.Additional or fewer IEs may be included in other embodiments.

TABLE 1 Information elements P Condition/Comment CR IE Type IMSI M None1 IMSI MME/SGSN Sv M This IE specifies the address 1 IP-Address Addressfor for control plane message Control Plane which is chosen by thesource MME/SGSN. MME/SGSN Sv M This IE specifies the tunnel for 1 TEID-CTEID for control plane message which is Control Plane chosen by thesource MME/ SGSN. The target MM may include this TEID in the GTP headerof all related control plane messages which are related to the requestedbearer. MSISDN M The MME/SGSN may include 1 MSISDN MSISDN IE. STN-SR MThe MME/SGSN may include 1 STN-SR STN-SR IE. MM Context M The MME/SGSNmay include 1 MM for SRVCC CS Security key in MM Context Context for forSRVCC. SRVCC The derivation of the CS security keys may follow theprocedures defined 3 GPP TS 33.401, v9.0.0, which is incorporated hereinby reference. Source to Target C The Source to Target 1 Handover-Transparent Transparent Container may specific Container be used totransfer HNB Information handover specific information. PrivateExtension O None 1 Private Extension

Furthermore, Table 2 illustrates the IEs for the Relocation Requiredmessage that may be used in conjunction with step 1812 of FIG. 18 and/orsetup 1912 of FIG. 19, in accordance with an embodiment of the presentinvention. The paragraph numbers in the IE Type and Reference columnrefers to the paragraph number of 3GPP TS 25.413, v8.3.0, which isincorporated herein by reference, at which additional information may befound. This message is sent from the RNC to the CN and is connectionoriented.

TABLE 2 IE type and Semantics Assigned IE/Group Name Presence Rangereference description Criticality Criticality Message Type M 9.2.1.1 YESReject Relocation Type M 9.2.1.23 YES Reject Cause M 9.2.1.4 YES IgnoreSource ID M 9.2.1.24 YES Ignore Target ID M 9.2.1.25 YES Reject MSClassmark 2 C - 9.2.1.26 YES Reject ifGSMCStarget MS Classmark 3 C -9.2.1.27 YES Ignore ifGSMCStarget Source To Target C - 9.2.1.30A YESReject Transparent Container ifUMTStarget or ifEUTRAtarget Old BSS ToNew O 9.2.1.29 Can optionally be YES Ignore BSS Information used if GSMtarget, but not used for UMTS target. GERAN Classmark O 9.2.1.57 YESIgnore Source BSS To Target BSS O 9.2.1.79 May be included, YES IgnoreTransparent Container particularly if GSM PS domain is target. ConditionExplanation ifGSMCStarget This IE may be present if the Target ID IEcontains a CGI IE and Source BSS To Target BSS Transparent Container isnot included. ifUMTStarget This IE may be present if the Target ID IEcontains a Target RNC-ID IE. ifEUTRAtarget This IE may be present if theTarget ID IE contains a Target eNB-ID IE or if the Target ID IE containsa Target RNC-ID IE containing a Corresponding RNC-ID.

As one of ordinary skill in the art will appreciate, various embodimentsof the invention provide a multitude of advantages. For example, theimplementation can be fully scalable since it places the SIP in customerpremise equipment. In addition, it completely offloads the CS Corenetwork of the session control signaling. It also provides servicecontinuity with CS as well as PS macro cellular. The placement of theSIP UA in the home premise equipment enables enrichment of subscriberexperience with subscriber based SIP features such as picture caller id.Further, embodiments place mobility functions in the transport layer, asopposed to some other approaches that place these functions in theapplication layer thereby requiring tunneling of transport layerinformation in application layer signaling.

Referring now to FIG. 20, a block diagram of a network element 2000 isprovided in accordance with an embodiment of the present invention. Thenetwork element 2000 depicts a general purpose platform and the generalcomponents and functionality that may be used to implement any or all ofthe CS UE 110, the SCC AS 124, CSCF 122, HNB/HUA 116, HNB GW 120, MGW134, IWF 132, MRF 910, and/or the like. The network element 2000 mayinclude, for example, a central processing unit (CPU) 2002, memory 2004,and a mass storage device 2006 connected to a bus 2008 configured toperform the processes discussed above. The network element 2000 mayfurther include, if desired or needed, a video adapter 2010 to provideconnectivity to a local display 2012 and an I/O Adapter 2014 to providean input/output interface for one or more input/output devices 2016,such as a mouse, a keyboard, printer, tape drive, CD drive, or the like.

The network element 2000 also includes a network Adapter 2018, which maybe a wired link, such as an Ethernet cable or the like, and/or awireless/cellular link for communications with a network 2020. In anembodiment, the network interface 2018 comprises a switching fabric forswitching bearer and signaling channels. The network interface 2018 mayalso comprise a suitable receiver and transmitter for wirelesscommunications. It should be noted that the network element 2000 mayinclude other components. For example, the network element 2000 mayinclude power supplies, cables, a motherboard, removable storage media,cases, and the like. These other components, although not shown, areconsidered part of the network element 2000.

Although the present invention and its advantages have been described indetail, it should be understood that various changes, substitutions andalterations can be made herein without departing from the spirit andscope of the invention as defined by the appended claims. For example,many of the features and functions discussed above can be implemented insoftware, hardware, or firmware, or a combination thereof. As anotherexample, it will be readily understood by those skilled in the art thatdifferent network elements, messaging, protocols, and/or the like may bevaried while remaining within the scope of the present invention.

Moreover, the scope of the present application is not intended to belimited to the particular embodiments of the process, machine,manufacture, composition of matter, means, methods and steps describedin the specification. As one of ordinary skill in the art will readilyappreciate from the disclosure of the present invention, processes,machines, manufacture, compositions of matter, means, methods, or steps,presently existing or later to be developed, that perform substantiallythe same function or achieve substantially the same result as thecorresponding embodiments described herein may be utilized according tothe present invention. Accordingly, the appended claims are intended toinclude within their scope such processes, machines, manufacture,compositions of matter, means, methods, or steps.

What is claimed is:
 1. A method for performing wireless communications,the method comprising: receiving an access gateway register request fora user equipment (UE), the access gateway register request indicating anetwork address for an access gateway and a subscriber identifier, theaccess gateway being configured to route user data therethrough, whereinthe UE is a legacy CS device that lacks the functionality to communicatedirectly with a packet switched (PS) network; verifying that the UE waspreviously registered in a user database during a circuit switch (CS)attach procedure; and pursuant to said verification, storing the networkaddress for the access gateway and transmitting a registeracknowledgement message, wherein the CS attach procedure is performed bya home user agent which separates a CS attach request received from theUE into a session control component and a mobility component, themobility component corresponding to the CS attach procedure and thesession control component corresponding to an internet protocol (IP)multimedia subsystem (IMS) attach procedure.
 2. The method of claim 1,wherein the user database is a home location register.
 3. The method ofclaim 1, wherein the access gateway is a home node B gateway.
 4. Themethod of claim 1, wherein the subscriber identifier is an internationalmobile subscriber identity (IMSI).
 5. A method for performing wirelesscommunications, the method comprising: facilitating a circuit switch(CS) attach procedure between a user equipment (UE) and an inter-workingfunction (IWF), the IWF acting as a mobile switching center (MSC) forthe UE, the UE being a legacy CS device that is incapable ofcommunicating directly through internet protocol (IP) multimediasubsystem (IMS) signaling; transmitting an access gateway registerrequest that indicates a network address for an access gateway and asubscriber identifier assigned to the UE, wherein the access gatewayregister request triggers a verification that the subscriber identifierwas registered during the CS attach procedure, and said verificationtriggering a storage of the network address for the access gateway, andwherein the access gateway is an access point for the CS device toaccess the PS network; and receiving an access gateway registeracknowledgement message, the access gateway register acknowledgementmessage indicating that the CS device is verified, wherein the CS attachprocedure is performed by a home user agent which separates a CS attachrequest received from the UE into a session control component and amobility component, the mobility component corresponding to the CSattach procedure and the session control component corresponding to anIMS attach procedure.
 6. The method of claim 5, wherein the networkaddress is stored in a home location register.
 7. The method of claim 5,wherein the access gateway is a home node B.
 8. The method of claim 5,wherein the subscriber identifier is an international mobile subscriberidentity (IMSI).
 9. A method for performing wireless communications, themethod comprising: receiving an IP multimedia system (IMS) accessauthorization request for a user equipment (UE) from an access point,the IMS access authorization request indicating a network address forthe access point and a subscriber identifier associated with the UE,wherein the UE is a legacy circuit switch (CS) device that lacks thefunctionality to communicate via IMS signaling; verifying that the UEwas registered via a circuit switch network during an earlier CS attachprocedure; and pursuant to said verification, storing the networkaddress for the access point, and transmitting an IMS accessauthorization acknowledgement message, wherein the CS attach procedureis performed by a home user agent which separates a CS attach requestreceived from the UE into a session control component and a mobilitycomponent, the mobility component corresponding to the CS attachprocedure and the session control component corresponding to an IMSattach procedure.
 10. The method of claim 9, wherein the IMS accessauthorization request is transmitted from the access point via an accessgateway.
 11. The method of claim 10, wherein the access gateway is ahome node B gateway.
 12. The method of claim 9, wherein the verifyingincludes verifying the subscriber identifier with a home locationregister.
 13. The method of claim 9, wherein the subscriber identifieris an international mobile subscriber identity (IMSI).
 14. A method forperforming wireless communications, the method comprising: facilitatinga circuit switch (CS) attach procedure between a user equipment (UE) andan inter-working function (IWF), the IWF acting as a mobile switchingcenter (MSC) for the UE; transmitting, by an access point, an IMS accessauthorization request, the IMS access authorization request indicating anetwork address for an access point and a subscriber identifier for theUE, wherein the UE is a legacy CS device that is incapable ofcommunicating directly via internet protocol (IP) multimedia subsystem(IMS) signaling, and wherein the access authorization request triggers averification that the subscriber identifier was registered during the CSattach procedure; and receiving a register acknowledgement message, theregister acknowledgement message indicating that the UE is verified,wherein the CS attach procedure is performed by a home user agent whichseparates a CS attach request received from the UE into a sessioncontrol component and a mobility component, the mobility componentcorresponding to the CS attach procedure and the session controlcomponent corresponding to an IMS attach procedure.
 15. The method ofclaim 14, wherein the verification that the subscriber identifier isregistered is performed by accessing a home location register.
 16. Themethod of claim 14, wherein the access point is a home node B.
 17. Themethod of claim 14, wherein the subscriber identifier is aninternational mobile subscriber identity (IMSI).